---
id: CONSTRAINTS
type: note
status: active
title: Constraints
created: '2026-09-09'
updated: '2026-09-09'
tags:
- requirements
- constraints
related:
- PROJECT
source_paths:
- AGENTS.md
confidence: confirmed
---

# Constraints

Explicitly documented constraints for this repository (source: `AGENTS.md`).

## Technical Constraints

- **Debian-only**: every playbook must check
  `ansible_facts['os_family'] == "Debian"` and abort on non-Debian hosts.
- **LXC containers**: tasks affecting `sysctl` or `reboot` must check
  `virtualization_type != "lxc"` and be skipped there.
- **Ansible style**: modules use FQCN (`ansible.builtin.apt`, ...);
  variable defaults live in `roles/<name>/defaults/main.yml`, never hardcoded
  in tasks; role logic is split into `tasks/<name>.yml` subtask files with
  `tasks/main.yml` containing only imports.
- **Templates** use `# {{ ansible_managed }}` as header.
- **Execution environment**: changes to collections require updating
  `docker/requirements.yml` and rebuilding the Docker image.

## Process Constraints

- **Documentation duty**: every new feature, parameter, or variable must be
  documented in the corresponding README before commit (see `AGENTS.md`
  mapping table).
- **Code language**: documentation in German, code (variable names, task
  names) in English.
- **Secrets**: sensitive values belong in encrypted `vault.yml`; `.vault_pass`,
  `setenv.sh`, `logs/`, and `.zabbix-psk/` are git-ignored and must never be
  committed. No plaintext secrets in `defaults/` or `group_vars/`.
- **Testing**: changes are tested in the Docker container (`./execute.sh`),
  with `ansible-lint` and `--check` dry runs where sensible.